SOC Analyst- Tier 2 Investigation
منذ 2 أيام
Doha, قطر
Madre Integrated Engineering
دوام كامل
١٢٠٬٠٠٠ ر.ق. - ١٦٠٬٠٠٠ ر.ق. عقد
مجانًا عبر البريد الإلكتروني أو Google
احفظ هذه الوظيفة وحافظ على تنظيم بحثك
قم بإنشاء حساب مجاني لحفظ الوظائف وإنشاء التنبيهات والعودة إلى هذه القائمة من لوحة التحكم الخاصة بك.
مجانًا عبر البريد الإلكتروني أو Google
بالمتابعة، فإنك توافق على الشروط & سياسة الخصوصية.
Madre Integrated Engineering | Full time
- Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
- Perform detailed analysis of security events, logs, network traffic, and endpoint activities to identify malicious behavior.
- Conduct incident triage, investigation, containment, eradication, and recovery activities.
- Analyze Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) to determine the scope and impact of security incidents.
- Perform proactive threat hunting exercises using SIEM, EDR, and threat intelligence platforms.
- Investigate advanced threats, malware infections, phishing attacks, insider threats, and anomalous activities.
- Correlate events from multiple security tools to identify attack patterns and potential breaches.
- Develop and enhance use cases, detection rules, correlation logic, and SOC playbooks.
- Document investigation findings, root cause analysis, and incident reports.
- Collaborate with IT, infrastructure, network, and application teams during incident response activities.
- Support digital forensics activities and evidence collection when required.
- Participate in security incident response drills and continuous improvement initiatives.
- Mentor junior SOC analysts and provide technical guidance on complex investigations.
Requirements
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
- 5-8 years of experience in Cyber Security Operations Center (SOC) environments.
- Minimum 3+ years of experience performing Tier 2 or advanced security investigations.
- Professional certification:
- CompTIA CySA+ (Cybersecurity Analyst), or
- GIAC Certified Intrusion Analyst (GCIA)
- CompTIA CySA+ (Cybersecurity Analyst), or
- Strong understanding of:
- Security Incident Response
- Threat Detection and Analysis
- Network Security
- Endpoint Security
- Security Monitoring
- Threat Intelligence
- Security Incident Response
- Experience with enterprise SIEM platforms such as:
- Microsoft Sentinel
- Splunk
- IBM QRadar
- ArcSight
- Microsoft Sentinel
- Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, Carbon Black, or SentinelOne.